The vulnerability is named after the infamous Citrix Bleed Attack (CVE-2023-4966) that was previously reported around Oct 2023 and was widely exploited, by multiple threat actors, including ransomware groups. The original flaw also impacted Citrix NetScaler ADC and Gateway appliances. CVE-2025-5777 is a critical buffer overread vulnerability dubbed as 'Citrix Bleed 2' affecting Citrix NetScaler ADC and NetScaler Gateway. The flaw stems from insufficient input validation, enabling an unauthenticated remote attacker to retrieve portions of the server’s memory. Exploiting this issue could allow attackers to access sensitive data directly from memory, potentially exposing credentials, session tokens, or other confidential information. CVE-2025-6543 is a memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Citrix reports that exploitation of CVE-2025-6543 against unmitigated appliances has been observed. CVE-2025-5349, an improper access control on the NetScaler Management Interface.
Recent news and incidents related to cybersecurity threats encompassing various events such as data breaches, cyber-attacks, security incidents, and vulnerabilities discovered.
The organizations using Citrix NetScaler ADC and NetScaler Gateway appliances are strongly recommended to: Review the official Citrix security bulletins, apply all relevant patches and updates as soon as possible and monitor for any suspicious activity.
August 11, 2025: Shadowserver Foundation reported that 3,312 Citrix NetScaler appliances were still vulnerable to ongoing CVE-2025-5777 attacks.
August 11, 2025: Shadowserver Foundation reported that 3,312 Citrix NetScaler appliances were still vulnerable to ongoing CVE-2025-5777 attacks.
July 10, 2025: The CVE-2025-5777 vulnerability was added to CISA's Known Exploited Catalog, based on exploitation in the wild.
July 10, 2025: The CVE-2025-5777 vulnerability was added to CISA's Known Exploited Catalog, based on exploitation in the wild.
June 26, 2025: FortiGuard Threat Signal Report was published.
June 26, 2025: FortiGuard Threat Signal Report was published.
June 17, 2025: NetScaler ADC and NetScaler Gateway Security Bulletin published by Cirtix.
June 17, 2025: NetScaler ADC and NetScaler Gateway Security Bulletin published by Cirtix.
FortiGuard Cybersecurity Framework
Mitigate security threats and vulnerabilities by leveraging the range of FortiGuard Services.
Assisted Response Services
Assisted Response Services
Attack Surface Monitoring (Inside & Outside)
Attack Surface Monitoring (Inside & Outside)
Attack Surface Hardening
Attack Surface Hardening
Information gathered from analyzing ongoing cybersecurity events including threat actors, their tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), malware and related vulnerabilities.
Sources of information in support and relation to this Outbreak and vendor.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
